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im^m 1 ] 

^ "7 ^ T y h :3 y 3. - ^ (D t ^ U - V- -i y iy 7. 7- ^Wt ^ c t ^ji < 7 V ~ 

3 yv7 h jLjmm^i'^ii^t ^tctbo). t-My-T ^ y ■^yx'r L.mf^\t/umV'< \ 
-T^y^'yTsfi^tomKmummt/uwiiy^'^^nKt^i^oKL. cntcio, 
mnm\^u^t ^^(ox'h^c t^^^tt ^iy7.T L.O 

[ II « « 2 ] 

y i^->XTAti:J>f-r5iI^W*gM)!)^ Hff ? n T t/^ 5 7 - a y © 10 

o . ■ * 

t -r 2 leig© -^'Xx A„ 

\cnt^^'^^mm^i^xs^^t^^-\f:7.tLxmkt^^<r>xtb^^f^^Witr^ 
cw^as] 20 

:i-'^U--r-fy^->XTA5b<Wi ndows --<-X<D:t'^U'-7'i'y^''->X 
rA-Cfe§J;9tCL, Windows Registry^. \ n \ y y ^ 

)\'\^nt ^^'{^it-t ^X^ \ n32 APMCd;oTtTt>n§*>OT'fe'3, mW.ifnxS^ 
5 n 5 fc fc gij M St S « 7 y U -5^ - 3 y ^ © m L ^ »i 1- § cfc 5 fc M IB M l![ 

■9--/^-*^6.|lt7?nTi/^?.77''J'^-iy3 y\Ci:^M^X&ri. 7^X1-7 leg if 
Ti/^5^fi!c4^-{c5htUT77°';y-->'3>A^.tBtfcSj)<T'fen, g5)ttCf5^§fc46tCv/X 

|g (D X r A 0 30 
[IS«JI 7 ] 

iilB^'^b-r'i'yy>'XrAaimft;/<SliUf"\'{i. ^fT$nTl/^.577"i;'y-i^3 y 

'T^'X^'^xosK^iii^f^cfc-e, \'o<r>7-:f^)'r-y3y<r>^m<r)^yx^y7s<Dm. 
^^Sat-StcDTfe5<:i:^1fmi:-rsiS*JSilB«<Di/XrA<,. 

lltT^nT(/^.577'U'!r-i/3y^>X^fyx*Mo©*iT'{i^l^ii^. i?i}3B*'^U--r 

^ y ^yTsT- h^ni.^t/um\y-( Bmmty\y h^^-^vi^to^^M^jiitsfecDr' 
*5<:i:^t#?Si:-rsilJl^«7lBlg©'>XrA„ 

n!iBt^ly~T^yifiy7.TL.mmit/Um\y^'^i}\ -f V X h - yl/?: ^tf b T- 40 
>'Xh-;l/«ti(DJ;9{ctB3El-r§«%^77''J'>-->'3>tcji«-r§ci:lcj;0>77''J 

fi)c?n5t,<DT'«>?.C^^!|t®^-r5il*rSltBic^0:>'XrAo 

^ ^ ^ 7 y h ::i y \^ 3.- ±(Dmmi,c ^ -dX 7 V ^ - y 3 y oymwti^l'^-^ ntz 

^n^hc t^m±r^rcib(o^m^t ^K^t^c t^^mtt imMm9mm<oiy:^T 
Lo 

im^m 1 1 ] 

IS*^9lBicO'>XrAo 50 
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imMm 12] 

^fiT'^^T^nstCT-feO^ mmm^<D y 7. ^ y 7. (D ^ ^ tf^ i ooS^Sx-^f'^- 
13] 

M^-T •/ V ^ - 3 y(omm<DmWL(0^ y 7. ^ y x(D o *>'>ti < i:fe2o*^ ioj.:^±o 

1 4 ] 
[ ifi * S 1 5 ] 

±m^Ui/'7 h V ^ryj ^--y 3 yi,cm^st^f)\ s^v'T.f-AU-v'T. h 'J tcwrs^ 

M«R)5±-r5€>^.Wi nd ows i^Mmm) Reg i s t r y :n y ^ y h ^ t lb 

im^mi 6 ] 

ndows(S^K^) RegistryST-aii^-ti-^ilil^l'fS-r-l.tfDT'fe'Sil 20 

in^m 17] 

. ^ti^MK^t ^^^(D^^m^t i>coT^ ^ c t^^fWitt ^m>^m I 6mm<oy 

7t Lo 
[ 0 0 0 1 ] 

^tamummmfiammQ 9/4 5 e. 1 s 1 ^n-si^mutamx-h*) . + » 

[ 0 0 0 2 ] 

^^ma. :jy\da.-'^V7h'>x7s iif)mm\Cti:t^\y-T'(y':fiy7TL.y7h^ 
X 7 »C K f S o 

[WlSffi] 

[ 0 0 0 3 ] 

i^tcfci^TS t«s*«ltg«. mm^-( y 7 h-fVi'^mrjincT zfv 'r-y a y^t <'ic 

n'irX't^CtT&^o - » tc , - gp O iJf 5)5 X r A T' « , & tci)' t f a ^ y Lt'' y 7 
h ~Jl^^ nx ^^^t-><D ^ o ici^ y 7 y h y XT L^^^^Lfz ^ . feSVMiy7 h'>x7 

i^mtim^L^i) tt?>mm'i 

[ 0 0 0 4 ] 

c <7DJ; a ^f^^^tT ^ tf^s J; 3 < cDKliA^^ C 5„ f ^ "fe . 7 y ; - 5^ a 
>tiiacD3yifa-^«fi)ti;OHlc?«. m C ^ fz it m^j: ^ 7 V 

"r-y 3 y(D^ y 7 y7ffm^'^-^t ^ c t . m K) m L ')&mti^mmx & ^ fcub . 7yv 
"r-y 3 yicnLx iKi^^j:mm^mLx . 7 "r - y 3 yicnt ^x (D^mnmm 
^ Bf] t ^ S'^ f)^ $> c t . m^<D7 >) - y 3 y xi^^A y T ■< ii tn^H y 7 7- L 
3>.i^-;t-.>'hA^^Sffl5nTv^?.^c46. momLi&mt^yxy-JimmAmmicfsi^t: so 
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o jffl T' S o 
[ 0 0 0 5 ] 

. ;j-'^U'-T'f y^^i^7.-rA»^fk/{*aUl' + *>€)€'3, tt ^ <t / <S ilP f -^^ ^ 
[ 0 0 0 6 ] 

om(6JgffiT'«. Wi ndows (g®^^) Reg i s t r y iOi -T ^ it t 
Wi n32 AP I^c<toT^Tfcn^ »it<tt'>Xri»A^M8!t^7>y^>-r-5/-c44>(D^S 

^mmt?>o cntcio, HS(*^iq^tf ai?n5^ct?c»u<oKi^*/c:fi7yu a 
?-©ift>*WL^fti»r-r^o «fc»*L<{i. ■9--/N*-A>e.^ff?nTv>57:^U'^-i>'3 

5o 

[ 0 0 0 7 ] 

Att^ft/lSiS U-r -V.A^ liqT^nTI/^57y'J-5r-v/3>^'>Xf>;^<D8!(^ 

mmt ^ c tx . \ ■oo) T >) - 3 y <D mik > 7, ^ y X (o ^ m mt ^ 0 coj; 
^'SHjiffifl^figT-a. ^gt7?nTv^i,77'uy->'3y'fyx^'yxAn -o (d ^ x 

^ . J2 f) ^ t y Y -y h ^.-^^ y B# g H ^ iS -S C i: A< 1 1 » $ L 1.^ o C © H fig fl5 ftg « , 
a>^S!9:§a-^f-(D/c46^c^S<D7:/'Jy-y3y'1'yX^fyXig:ll^fT*t§^ 
:i-.f'->i-'-^U-f-^'yy-yXxA^-9-5K-h-rsci:tBjtgT'fe5„ 30 
[ 0 0 0 8 ] 

CCOTcib. ^ ^ - T -{ y 'if iy X f- L.m^it / urn U ^ tiK 'l'yXh-;l'*||ffL4V'' 
T't'fyx h-;l/^^T'fe5J;9»i:3Ein5«Ji^7y;^r-i/3 y(cig«-r5c CtltCj; 

0. 7yy'^-i/3y(DiiffBttcf'<T<D^SA^igSiSiitct/ce^rns rMiK-ryxh 

- /I/ J fig ^rn ^ a $ fc. 7 7" U - 3 y !bW y X h - ? ti T t/^^ ^ ^ fi . H ff ^ 

ic7^v "r-z^ 3 yomrf^mmicm^t ?>o iff^L\,^mmBmii. ^^^7yh::iy\i 

a-5f±(Dlf$SK:<fcoT7y;':r-'y3y®jf^*<T^|i«S«-§ttfc!?,^M?n5Ci:«r 
t ^tcibn^U^U^.t ^0 ±teo<};9ic. -gpoHfig/gfilT'tt^ |b| i; 7 7 y h 3 y 

yu^-y3y(DijfeolSl!f©i'yx^yx(Dd-^cD'>%<i:t,2o*MoW±© IS 2® 19 
[»B^%^fili-r5fci6a)«M<0JK^] 

[ 0 0 0 9 ] 

iai{i.-*5gB^, ^f^u-x-t-yyyxf-i., fcj;a"y7ht7x777''jy-y3yois 
^ w M « ^ * f 7 D >y ^ us 0 T' s o ^^jim(r)^^L\^^nmw>mi,t. ^ y ^'y 

7.7- h^mit/umu^ '\' (1 00) ^mmt?>o cn^ r^t-^u-r-r y ^/yxxA;<f 

- K J i: ^' o gp W fc ti , $- ^(D :^ ^ U - f- ^ y y X f- L ( l 0 ) ^ ftHc 7 7* 
'J^r->'3y*^i:v^lc»SL^9Ci:>&K±-rsi*SK^'fy^tiASo b*^L. ttW^f 50 
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nr ^ '> 7. T h V V - X t ^ (D m(o ^ < (o t ^ u - T -< > X f L mmic J:. -3 r . c 
(DSHK^-r^A^fe^fc^e^nSo ^ - y- ^ > ^ X 7- L mm it / um ^ n 

0 0) (i . 7 V ~ 3 y U-<)im(DlSi t A. E comii.i'¥m^ fj: < t fcibic. a ^' =r L 

nrcmm^ 7 y V - iy a y (so micmmt ?)o 7 -fv ^-y a y (50) t 
^i-^u-T-fy-yi^xf-h (10) t(DmicmE-snrz7-fv^-i^aymmit/umu 

-f^ (1 GO) ttK t^U-T^^y-ifi^Xy-L. (1 0) tC)i^fr5iljtW*SMA^, Hff^ 

ilLTWindows (SiSB|g)^-XcDi/XTAT'«)i^, Windows (S^S 
^) Registry(C^-rS^it(i-r'<TWln32 APMCioTHtT^n-i.o 
'^^t ?> J: o IC^ QueryRegEx-^GetProfi leString^ifOi^X 

X i:. M ifc *^ i¥ 0^ aj ^ n § fc o" tc gij (D M ?s t 7 y u ^ - i> H > c o pf t^' m L 4^ K -r 
s.t'pti:. c ni<D'> XT i^m^^y y ^ t ^ c tti^X' ^ 7 ^ t -/icsm-^ nr\^^ 

o 

[0010] 

C C T'^^ffl t TV^5 r:^^U-7->(yifiyX7-L,^-h'J i: l/> o ffl |§ Ji - y <y h n > 

b - r f > ^- 7, 7- A i: CO fll {c BB If $ n , 7 7" U - 3 > ^ 5i< fj T ^ i> Jl *i #t 
■rsU"i'-V^lc«-r§o c Ojg^giS^fc « i/^ < -0*^0 g 6g;b^$, § „ ^ico.gWfi. Hff^ 
nTl/^i.77'D'y-S/3>(Cj;oT^^'f7yh3>'t:a-^f*^^M5n«(:i;^g^±f 
SCtT-fe^o 77°U'5r-i/3y7!,<^'^^'7>|.ri>'tf3.-^©a*;t^^-x-<>'yv' 
Xr- Lm^cD^^^U^ ^ t . C CD^Jgtif^a $ n. (giS^^T'CD^^M*^ rtTfcn^J 
o fct^ti*. 77'Uy->'3>'*^~MSVCRT. DLL;S:if(DjtW^:/i^x^h(D/^-i/ 
3y^^Mb*'5i:-r?.t, il©^M*<7y;':r-i/3y/c:lttci:^«)6n. =7 y(7 y 

[0011]' 

t/>§77''J'>--i>3>{i:ji#t-r5(:i:T'$,§o 77°'J':r-;/3y(D^tT^, t/c(i77''; 

^{Ct/ca^nSo /ci:^{f, Adobe Pho t oshop (R) ^ifOnytfa- 
^•fvif^L,i)\ -jiOWi ndows (S®^^) Reg i s t r y X. y h V if^ U K 
EY_LOCAL_MACH 1 NE¥S o f t wa r e¥Ad o, h e IC h ^ t L X ■ 
§^n(C, P h o t.o s h o p*W>X h — ;^^^aTV■>^l/•'fc^6^'7'^'7>'^3>fcfa- 
^±©HKEY_L0CAL_MACHINK¥So f t wa r eVAdobetCCnP. 

(Dxy h >J tl^^tEtrjiiftm. :*^^m(0 c (ommicvto iy Xt- l^ii. htcly^^ ^ ^ 7 y 

h3>'tfa-:S?± (C^e-r^ CD <i:9fC, cneOUJ^ XhUx^hU^Pho t o s h 
opyni^-75>i'"3-K{cWtT r,T^-rj„ 
[0012] 

7yu^-^>3y(0®)fFA^T!$^/c{i^^g^n§ci:;&Kih-r5o /ct^ti\ =L~^f-if 
HKEY_LOCAL_MACH I NE¥So f twa r e¥Adobe©TtCPho t 
o s ho p O S Lw-? - 3 y ffl CO b >^ X h X > h U gl (C # a L T l> 5 4^ « T' . Iff b 
--^-i^'sy^^Kt/ct^l^, i:n6Oxyhij;&ffU0^7yU'^-i>3>*^c>^, LTM 
^ B/j <' c i: T' t § o 
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[0013] 

5 7 -ir - 3 y !/) 7 y D <)/ ^ f ?! o C O 7 > D -y ^ rI fig ^ O « . t If. IS ^ fC 

©^^*^ e)g?ii-r Si^^S*^* 5 T-$r'^-X07KUX{cov>Tc0^^^M*BR5i:i:^ 
mnt ^ C tffh ^ o C:cDU-y'XhU4^-«HKEY_L0CAL_MACH I NEtc*§ 

ilfi?ti?.i:i:6^^t/>/c:i6. c (om^ii ^ ^ -{ 7 y h zi y :x - ■S' ±i^i,cmm-i o ^3.- 

■o (D 4 y X ^ y X ^ m i:^ <7 ^ -< 7 y h =t y a. - ^ ±X' mn L . ^ n=en<D ^ y 7.^ y 7. 
^ mrs. ^ - ^ - 7.\t^m.-r: n ^ 0 \trs :^ ^ 
[0014] 
3 > r + X h 

C£D^t6A^fe?)/c46, >/X-rArt07'7-r'^- hn^r^X hT'§77"U'>-->^3 y^% 
tf f 5 C i: T' t 5 o 7 «J -ir - 3 > tc t T X T A !5>^ ^ CO J; 0 ic a 5 *^ . i3 J: 

oTCn^HS-rSo 02T-«. 20cDfiSiJ7-/'J'y-'>3> (52i:54) SfcfilBli; 
Y -f \) fT - 3 y (01CO5O) <7D2OC0'ryX:5f>'X{c7''7'l''^-ha>'T4^Xh^ffi 20 
^tSt:i:*^T'tSo <l(D>''7^'^-h=i>'T + XhT'{i. i:nP.<077''J';r-i/3>$ 
/■ctt-OX^yXA^ >'X-rA-9--tfX. PfiK, *5j;t;-f-^f«fflgiJat;-f/caS!S:5 
3 tf-^# o J; ^ {C*t^ 5o L^^^^Sfil1iT'{i, en *■« X x A (0 gE^ SS^t T* -5 o 
[001 5 ] 

c o«ff,^t(2;?i-r ^ o i: T'. *%w©*-?u-r y^^'-yxrA*"- F (1 00) a. ^ 

3Sc07:/';'y-->3> (5 2i:5 4) *^-gl5Sfcfi-r'<T(7)<Sff,©^%«WT'^5J;3^ 
s ^^W-SiJffll^n/cayr^Xh^jS^-Ti.CtfCt-l.c COdtfi. Mi c roso 

f t Of f i c & z <ri7 -f ^) ^ - y 3 y 7. ^ - y ^ . su <D77'';-!r-i/3>'A^i^^E-r 

Stli)f^*^S^oT<577'";'5r-i/3yfci;^TaS T- 5 „ tztX\,f. ^ - ;l/ T - 
77'';'5^-S^3yT<^ffl^nTt/^§„ i:©<i;d^7-/U'y-i/3>'(iWo r do-fyxh 

Ul/^llllJ^^T'ti, |p|i;77'';^^-i^3>'O2O0'ryX^yX!?)^^^T'*-(D3yf- + 

Xh*«WL. -73. 2':>nf,\\m(r^7 ^) ^ ayiS^-f V ^- V -:iyy- ^7.Y itm^ 
■r^o astC^NL^Ccfc^tC. 20(D77°U'>--v'3> (52i:54) ^^ffRfglTfef). 
;t-^L/--r-i'yi'*>'XrA;^-K (1 0 0) *^ ?iJfflBjft6^>^Xf-A';V-X£0«Wtfa 

[0016] 

IS It 

El4fc^Lfc<fcaic. ;i•^^-r^•yy'>X•fA^-H«^*J<D^t7■i/XrA'*>e.^^?fi)^^t^ 40 
So -r&t)-^. 37 (1 02) , (1 04) , -7 r ^ )\/-^ ^ - 'J ^ (1 0 

6 ) . « ^ :t 7 X h •=? - + (1 0 8) . -r / W X V - ■\' (1 1 0 ) . 7 * y 
hv:?.-^;-^ (1 1 2) . :/p-bXv^->>-\' (1 20) . 7'D-bXii%-r^--y"^ (1 
1 4) . (1 1 6) . :fc<ttf';*/^UV^-i;'-V (1 1 8) *>P)«l^2nSo 3 

7 (102) . T'P-bXV:^-^;^ (1 20) , *3j;tfD-^^- (1 1 6) n:W.<st^X 
cD+»-7yXrA«. J-XTT'PfiRf^^RSftyXrAcDS^T'S^So 37 (1 0 2) \t^t 

\^x. 7-f^)'T-%/ 3 y miist.yT^)ix^m-^n^7-:f>J^-iya y<D-iyT=^7 h 

[0017] 

*'^U'--f-i'yi'*-yXrA;<;-K(D7'D-trXVJt->-'y-v (1 20) ici^X , ^^©7*D 50 



(7) 



JP 2004-533054 A 2004.10.28 



■trXSfc(i:Xb-yF-r^>h«r37 (1 02) KM^X' ^ ^ ^ o iztj: :^ , $ fc . •:f a -t 7. 

(120) •fu-t7.^m(Dmmt:^]yy\^mm(orc!it)ic. ^ y 

U - 3 > y K ;l/ tc -r 5 C t T' t § o 7 y ^) ^ - y a y f^y V )V t \i . ■t^XiS^'S. 
(/^(c(gjBU V-X^J^^r i>7'a-trX<D^*;l/-7°T'^§o /ci:^{f, M i c r o s o ft 
Wordi^Mi c roso f t Exec lA^Zl/U^^-'^gy — ^irUTSiil-r^/'c: 
i6K, -EJil/i^x h U i;^*<R7 r -Y/l/'^XxA^^WrSii^A^^S. n -b X v - 
•V (1 20) i,ts c 0)7 fv ^-iy 3 y/'^y h'^i^^ ^7fv^-yay} fc^^fo 

T'D-trXV^-i/'t (12 0)*^77°U':r-->3yo)g»;&Jg^$n5fT'. 7 Zf V - 

-y 3 yKmt ?>m^tl^^^t ?>o SiJO:/D-tX?r7yU -y--^ a V/^^y K^Vtc n- K-T S 10 

C 0 0 1 8 ] 

^nm(Dn- y 7.7- h (1 1 6 ) ^ d ffl -rn {4\ * ff ^ n r i.^ § -> x -f a tc is 

^^^.teilt L/C ») , s^Xt AA>e.|gjgSJ^^4gjM-r S C t *<T' t 5o D-^- (1 1 6) 

o {giBft-y-^i^xr A^n^na. d-^- ( i i 6) lx m^^ y 'J 7 ;vitb . u 

/'^-X7'D■bX?rJffll:T^fiJ^^K^r?•r?>Ci;;^)^T■t^o ?^IC. d-^^- (l l 6) «is 
|igWD-F/7yn-Fi&II^TL. I@ ^ O O « * ffl ^ ^ ^ Hi: T * - S i^lg tc "T 
S c i: T' t § , 

[0019] 

uyxh'jtmts. 20 
wi ndows (mmi^m) xit. m^wnti^-mic^m-^ n^iipf^t)'^ z-d^ ^ o t 

rj:t>^s Wi ndows (S^ffiH) Reg i s t TytiyX7-Ly^)VV]mit7 7-f 
)l (w i n . ini*3cJ;t>* system. ini)-e$>5<,?e>tC^¥WIND0WS( 

mmmm) ¥ s y s t e mt^w- f u a> 7y'j'^-->3 >'*<7:/y -y-j^a i^a*© 
efi)t$fciiWmfk7 7i';i/^ J; < »t>iiy^R(TT'*«o ttc. 7 -y a y\t . d- 

ndows (SgJiS^) Wn©'/? -y F 7 ;J- - A tc »i Registry JCffiSTS © 30 

1i^■tf^A^j;<1Slrt^n§7^■^'^^^'JA^■#ftf?.o X Wi ndows (SIS 
B^)tC{i, app-defaul tsr-i'U^i'hUA^^^o Mac intoshlctiS 
y s t em Fo 1 d e r*''*!?, ^ <r>fii^<nic ^ y f y Ts^r L.\Z.\tn'^^t 

A< # ft -r 5 o ^ 0 2 L /-c J; ^ , li i: ^ © U N I X ( a S! « « ) X X A T' « . 
<@'!?c077'U'y-'>ay (52i:54) •en^^n^^^coiifig (l ^ l t l 54) ^rn-* 
;V tS f 5 c i: AM* i: ^ if' T' & S o 
[ 0 0 2 0 ] 

*l§0flcD-|ISi6^«|{C{i, igS^Wi ndows (S^jSti) Reg I s t ryav.K- 

y F A< # t n s o c: o 3 y - > F fi ^ ^ ftg u v-" X h 'J * 7 ^ -ir - 3 > {c a -r 

a^i^Xf-AUi^'XhUfCWrS^SJiK^-rSo 7>^U^-'>ay*^7i'-trXf 40 

t;t»^T'tSc COT^ST'ti, *%«gO:t'^U-r-i'y^>'X-rA:^"-F (10 0) t 
Wi ndows (SiJS^) Reg i s t ryA^ Uv'XFUti:7^-feX-rS/cA6cD2 

mmyu-tx^m^t 7-f')'r-yayti^^~^n7^^7.^'Z-mtt^m^. 7-f 

^) 'T-y ay\t^ ^ % i s t ryt£rav>^^*So ^ ^X^-f- ^ y f y 7.T h.iS - Y \t . 

yy>'XxA:y'-F{ig*^Wi ndows (g^lKS) R e g i s t r yST-jij^S 
■li- 5 (1 ?r If pj -r 5 o ffi©gM*^iS*i e. n/itf^. >y->X-f A:^f- F«. 

^ni^tcwrs^Mo^fFRj-rs, ^^^7 f ^) t - y a y tn^ ^ - \z.7 ^ ^ 7.-t ^ h ^ ^ 

^<n^~\t-^^V-=r H y ^yT."}- S*tt||(g©Re g i s t r y 50 
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[ 0 0 2 1 ] 
[ 0 0 2 2 ] 

$ L !/> H Sa S « T' (i , ;i- b - 7" ^ y y -> X r A A' - K a $ -r . 7 y'' U ^ - a :/ (c W 10 
■r 58* U v'X h U X > h ij «r^€y -r- ^ 7 r I' a- K -r 5» , a--»f-(0»* 

^S>&1&tyS2©r-^f7rY;l/;^>^D-K?n5o iSfSlc. ^-?b-7^-t'"y^'"->XTA;y 

^> Sfi(D7r'f;UF^©«g*^±»t ^nSo a--tf-*^«jii)Ty:/'J ^--^ 3 V^^fTt 
^2<D7'-^77-l'/Ki#ffiL^V''o t*>b. ^-t y 3 y (Om. - r ^ y f 7. 

[ 0 0 2 3 ] 20 

ny 7 ^ ^I'ty y 7.T hff^y 7 ^ j\^^(o^m^^^ o fftL\^'mmiBmx'h^mz<oy5m 

X'li. 7 y V ^ - y a ytf^'N i ndows (mUlSm) APlMSGetProf i 1 
eStringVWri teProfi leStringfjiE^f^XStiiLX. C tX ^ (O y 
7- -r;V5-SMf 5 C i: *^T' t 5o COT^ffiT'ti, W<^) * f- -f y X f- A 

[ 0 0 2 4 ] 

« W 4- 7 i>" X h 

y yf^- ^-y h a . mi&(DT y V - y a y ^ fcli -< y 7. ^ y ^.r- 1^^^ ti ^ o -HSfc, c 

afcr--r-5igj.s*'!*i/^„ ^rz. iO^m ^ n ^ - <d ^ ■< y ^7 v ^ t ^ u - f- ^ y y 

i/XTA-^y:J^-i:-9--K>'^-f:-i'*Mt^-eEflJTtSJ;9lC*So Wi ndows (S 
^Sffl) :/5-yh7;t-AT-{i, DLL (:5i'f'-i-57^Uy^^-l'7^';)*^77'';'5-- 

y a y^'prn^oyr y V & - y a yrsx-n^-^^ c tfj^'^i^^o "tcoi^^y^ y h y t- 

AT-fe, F>5®{i|5li;T'fe«o Ma c i n t o s hT'tt. I N I Tti.ktf^-OfffiOv'XxA 

a y - ^ y h fi^ 7 y V ^ - y a y m ic tj - ^ n ^ o cn&on yf^ - ^y h itci>im^ 

„ UNIX (.mmmm) yy.Th.x^i. u- Y^f^(D'mii^^T ^ ^ mm(D%mi'j. 40 

* T'»lfi^«^;i-7"';/*x h itctTLM" . s o " ^ y ^ y 7 ^ )\^) t^T :f 'r - a 

yx^m-^n^o ^<o:/a^7AT?«K^o" i i be. s o" ti^mmt n^hts^ . c<d 

V 7 7 U 7 r 1 i b c . so. 3 if - gP O - a >"\ O > jf! U -y ^' V > ^ 

;b$n5o 77'U'>--J^3yfPJ5!t#«s <tfi!cLfcy7h'>x7A^«W3>'.-K-^yK0 1 
ot/c«-g|5(D/^-S^a^'i:O^E!iftT't5ci:^»loTt/>5o t:(?)fci6^^(c(i, 7:/ 

C ti)^-m^X$>?>o ^(Dl^a, |BIi;'>XrA±T'3^fT$nTV^5SiJ©77'U'>--i/3 > 
A^ijf^Tt * < *5pItett*<^«o 50 
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[ 0 0 2 5 ] 

Windows (l^ffilf) 98tWindows(l^S^) 2000tc*3V''TM 
icrosoft Windows (g^ffi^) Protected Fil 

e Sy s t em (WPF S) K ^ K) . X t L. ^ It 7 V ^ - 3 y <D ^- :^ f 

Ui^h'JtcxxxxLOCAL (xxxx(Sfi2;?i?(D;S:i/>lltTPj^6 7r'r;i'S) i:i¥{fn 

57ri';U*ft^T't5o cntcj;?)^ Windows O^ffli^) Loader *'«L 
o a d L i b r a r y(D||fT4'lC/^X#!!a*l^8(lf5:)^a«-^S-rSo fc^cb. mm^^ 

± ic m ^ icii c nx' It ^ i- ^ X' ^ o ^ + ^ X & ^ m I (0 m ^ a . xxxx7t^;i 

<D^mii. A»c J; o T± t %M*^36 5o S 2 O 9 e& ^ 3 > 4? - * > a V ^ 7C 10 

H b r *^ e. p - A 7-* -f 1/ ^ h 'J :^ X h - ;!/ L , fc " . local" 7 r ;1/ 

l'Pfi!;t*{tn(i*^e)*l/>*^e>T'fe5o i:n«, WINDOWS ¥SYSTE 

fC, C (Dj»j*>4T'{i. ^rn 5 l§lflg-r '^T (C *f 50, T- 1 5 IfP « ft l^o L o a d L i 

brary(D^fTtf, Wi ndows O^iSIS) fi. ny^l?-^. >h*^B^,T^W*/-cfi# 
B^/T^WftL o.a d L i b r a r y©if'^?.<DlSSi:tT)!i?j**nfcAv tfc.W^ft (t 
/c«^ai©) DLLT'$)5Ci:JSr;T>tRegi s t ry Key*^#S'ri.*-'if?*-'tC]C5 
UT, Sft^/^X^Si-bV^x^'i^x^rfigffl-rSo CKD'^r-J^T'ti, Load L i b r a 
r y If OFttJ Lli^tCW I N D O W S (SSIS^) ¥ S Y S T E M t -< U ^ h U »C St ? n 
§o , 20 

[ 0 0 2 6 ] 

DLLfcJct/^iDffiWftWnVjK-:^.^^*, lltT^nrt^STyj'ir-i/H^A^^f^b 
T t/^ ft 1/^ tf ^ « n y 4? - > h S M ? n ft t> C i ^ ffl liE -r -5 46 tc . # Pi >> y h -b v 

yt:^^ly-7-'{ y ^' y 7.7- h^w<r>^ . c <Dm^K'^^ C tiJ^Xt^o 
[ 0 0 2 7 ] 

* y h £0 - s/* 3 y ^ rc ti - i'" 3 y to IB H § s i. o . 7 - y 3 y 
OUff^t. 3 y 4^-^ y h L < c ^rfSSEf S c i: 30 

o * % 0^ T ti . ^ 16 tl ;'7 *"i » n «\ eg. S ft ^ ^ (i W P F S S fc ti ^ O Iti (D ;f P - f- f y 
^*i'Xf-A;Srgl!)6^tc^lBT-5i:i:feffg$n5o C©^^. jt^Sftny^l^-^yh^^ 

ft S^IIJ; 0 felti^T'feSo ft-tfft?){f, i^-gft 3 y 4?-^ y h *^eitc ^' yx h ? n 
'fyxh-;i/:/Di^'7Att3y4^-:^.yh*'ryxh-;i/Lfti/-'Ci:*'«^i> 

^ T- 5 o 
[ 0 0 2 8 ] 

0 Wi ndows (l^S^f) 7'-7>yh7*-AT'(i, MSVCRT. DLLA^COPp^S 
0::^tfti®BT'*5o C©4-7'v'"xi^h(D}SlgC(D/^->'3y*<Mf.t*?nTV^-?>ii^, ±)$ 40 
©Regi St ry+-«riiWtC^MLT, LoadLibraryMS(T'iELl/''3y4< 
- ^y Y - 'J a y^m'(kt ^ C i:*<Tt§o IELi/>3y4^-^syKDD-K^f»|iE-r.5 

^ C tX&^o COl^^/^XlCcfcoT. >'Xf-A7'rKay4^-;t-yhOijtcn-;t);U3 

y y h A^et^-rfl?}5^^ nso ie Li^«w^7^^x h ^fl?)3i;-r ssuw^^aa. i/y.K 
u >y u y ^ % ffi ffl r d t § o W n y - y h (c 5ht L T y y 4-* u 7 y ^ ^ 
f^fi!c-rn«\ m'n ^ ic a y \d 3L - ^ <D y 7 ^ )i 7. V- L ic ^ -o X zi y 4< - y hi&'iJ. 
Sft3y;fs-^. yh(c!)«»-r§cfc9fi¥(^-ri.i:t*^T-t-So fitt(0;^ffii:bT. ttW^T" 

WfCj;-pTf»rt> P-*;l/i>'XxA±$/c:ttz|s^WO+J-7'-y XT-Art Kl^fe-rSpI^tt 50 
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-g) 7 r © IE L V - 3 > tc IB] tj- T IS W IS ^ f 5 C !{)^ T' t S o 
[ 0 0 2 9 ] 

|/^<■:^A^©!|tSlJ*^gffi*^#ft■r5o Windows (mm^m) 7''7-yh7:t-AT«, 

m^i7'¥(0m.^t relit (D If vt-t xmv ^' u- /"ijVlzn^-t ^ i:. o . OLE. ODB 
MDAC. *5j;t>'^(^fi(D'^y^-EI^©^S(Opy.K-^yb*<Stii*nTi/^'l. 

[ 0 0 3 0 ] 

-«9tc, B^SSfc^^snTV^^fti^li^li. ift^lS5ih<D/cJ6(c^^W:t 7'>^"x ^ h^y-7'r-< 

y '^i/ Xr- L.iS- h' \C r T ^ r- -< y'K'Sm-i nr ^ti^ E 0 -h'lCti^t'h Pj-f) W 
■r-SiEH/-'a>'4<-^>yh ,co-d - K ^ W T « 'S: ^ i/^ o ^ (c , y X t Lti^ ^ y y a 

Lfc^-B. m^t^u-7■^yify7.7^l.i)^±m^trc^i^m•^^tlri^^rJi\,yi;^)~yrJ:^ 
iciii a f § s *^ $> s o • ■ 

[ 0 0 3 1 ] 20 

7 r ;P 

^<07:/';'!r->'3y(i. iS^X>h«;S/-c«?-<Dflfi<D77^U'!r-'>3>x-iSt?:tSiNS 
■r 46 tc 7 7" 'J - 3 y T' r - ^ 7 7 ;!/ ^ <^ ffi -r 5 , * % fi . ± le O -*J b 

X h u gg m t € iB 7 7- ;i/ 7. r A ^ if #t -r 5 o 7 7° u - 3 > ;!}■! i) -r 5 tti {C , 

*%B^{i7r'f'>'l/i-7.rA^Ml^SOUXh^D-H-r5Ci:ft^-e^§o SMt^^tcti, 
7 ri' ;i/ Hi f i: . {gff.^iitc 7 r -C/l/^ilftp-r S c i: . <R«iai^i^©»J<o 7 r 
7r'f>'U^';^''fl^^ h-r?)iii;^i::6^$^ni)o 77'';'>--->'3>A^7r')';Utc7i7-b 
XL/c:D7T^>'^^^St/il-&{i£^•r*'^^-f'1'>^i/XxA;^^-KA^ ^ O) y r ^ 
lyi' h t ^ -Z^mt)^ & ^ E d f)^ ^ "f- 1. -J ^ L . V ^ U h t ^ 'Z-nti^ & ^ ^ 

ttf^Li^^mmmmvii. ^<Dm^^^<u-7- ^ y 'fy:^^ 1.^3- h'm^r'm^t^ ti so 

[ 0 0 3 2 ] 

:x~^~(Oa-:^)\^V^'^rKm^iMsrz»bKT:fU^-y aya^mmy )\y(Dn^t 
tzum^y 7 Jl<0:ir~-:fy^U^rzi§-^. yir^ly-y" 4 y '!fy T^t L.i}- \^ it. v^^ 

b^l^o^T'77°«J 3 y*mo - F$n-5*g^. C <Dy r ^ -y My 

7 7 ± (C'ft s -r i, gi # 7 r 'T ;l/ O ^ iG IS * ^ fc ^ , - ^ y f y 7s9 UiS 

- Yit'iny r ^ ^ \y ^ y ^ yif-^^yv\z-3\t-\.xiT^. ^i^n:mm.\.r^ii n 

tf^ 5)^1/^0 7 r ;l'^^XO$^^ V -y If > >?'^iSfffi-r i) /c4i) , U b h ? n/c 7 40 
ri';Ki7C<07ri';l/i:PlU*ISTfet>T«^e.*t/>o *f * t v^^jSHJ^SgT-a . ->XrA 
o-t: + i';7^^'t7:/y'5r-i/3y<D5^tt^g:^IUit«-rs/'ca&(c, I N I 7rf/l/% 

C CO J; 9 fC a ^ o 
[ 0 0 3 3 ] 

*^B^tt> H7-^«-^tTSH^$nS7:/'J'^--i^3:/lcMtTltfcWfflTfc5o 

c:Oj;9^^ii<kT'tt. y7b't7x777'U-!r-v'3>'*^}tSffl«CDf'-^!*^P.1i^?tl 

■Si:i:^Ji«-r5ct*^asT'$>ti. y7h'>x777°y'>--i^3yT'{^ffl^n^7r'i' 
>'Vco;k;gi5^^;&{iSijcDiia K-7 -r is,wr 5 c i: fcM f bi.^c 7 7- t us^ 

*n57y';'>--i/3 yia^Pi^xr A«. ^77'f ;i'*^i:n5©aiHO'/^-fnT*s*^* 50 
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v-i/-r^j2:>SA^fe5o CO) mm it. t ^ u - f- y ^ 7. f l a - y: t/ x f- l. t'^m^ ic 
c 0 0 3 4 ] 

T ''^'f' X K 5 

c 0 0 3 5 ] 

^ < (D r 7. H -7 -r , w D - F Bj tg T § 9 ii ^ 5 n o 'simT&nist 

T <D T / W X K ^ -< ^ f) W »c n - K -r S c *K W S b i/> 'A- fig T ^ -5 o ®i B# fc 

a--<f-tt i:cD5?]„^^f#TV>*{^ntfJ5: e^i/^o X -r A "tij iE K L /c ^ , 7 ^ U -5^ _ 
3 y^iu[ilf?± tfc i: il 5*^ e.;^iB!-r C i: A^at bi.^o bTb^L. x/WTs F ^'T/^tD 
ai:A.if«i!)Wtc7>D-Ft?)Ct*<T't^i/>o F^'i'/^^®)Wlc7yD-FL.:*t,^C 
i:*<aSLv^*^ c n*<^ilT- 1 , :i^(5i(7)Wief)^fcN'iJl^r § ct ^ tc F^-fv^ 

*'v-^^$ns, a--tf-{cc:©c:i:«:a»]fSctA'M*Uv^o '^Ih1«0S@»!)©M.©7 
T'U-y-i/a y^t7*^2ltaT'$>§«^, ->XxA{i F5-l'/^**<#^i•r5Ci:^|g|St. 

-^y v^^mt ^z. fc/)^M*H/^o 

[ 0 0 3 6 ] 

* fg Bfl ^ IE L < ffi tg ? -y: -5 {c (i , § X / W X F V ^ ^ X o l^ T a * W ^ 5i {« t 

^S•r§>'XxA>'^-F->x7fflO■r-'WXF71' 
/^;Sru-F-7yn-K-r5(:i:«lifL<*i/^o. :^D^^5yif©Sa$i:V^a^T'« 
C n « jff S L ^ Sg Jf$ il T (i ^ (/> ;^)^ * ^ O SB ffl ^ flJi f -5 O T' « * < . glj S * 

B yn^mmm^umt ^m-^X'^^, 

[ 0 0 3 7 ] 

M i c r o s o f t U^<0-fy y F 7 * - A T' (i , x X F ^ £D M V S ^ 5 C t 
*^^l/^o Ma c i n t o s hi/X-rAtiH^fi^F^'T/^tilfi^F^-l'^^O^fXTj^-y-^^-Ft 
ilF^'r/^{i-r'^T|BlU??aT"l'>XF-;l/-iJ|i^$nSo Mac i nt oshi/ 

xxA7*/i/^(cuyi'-r5i:i:(CcJ;>). 'i:^s*+^.■J<-FA<^l«^nSo UNIX oii 

K^) i>XrAT'{i(5i:A.i:(?5^^. rM'YXF^l'/^^ffffl-r-5/cA6(c. ^fTPpf^^UN 
1 X (1 ffi ^ ) * - ;l/ ^ M L /cIS -e S $B ») u ^ n «' ^ a ^ 1/^ o c CD 7° p -t X ti If 
'fit It $1 ^ ^ ^ o » $ L Wjl^ SS S T- . C O y □ -b X AM^ ii fb ? tl i) ( 7 7" 'J -^r 

-•^aV^TtiWA-^twl/U-tr-yhi&if) » COT'n-trX^-SgWsfeffti. Wi ndow 

s (s^K^) 7yu '^--y 3 ^'{coi/^Tgi^ Lfc^ft (^^o«i«5aiisiig) ^ibiut- 

h<r> . L(D ^X^-T- ^ y iy 7.7- h\cm^L fc a - if - {i fj H^t f 5 C t 

T- 1 5 „ 
[ 0 0 3 8 ] 

<0#tor/WX(cMii-r5fe<0tc^t)4oi:i:fc*/'c^||#lc7)S^n5c:i:T'$5o 
[ 0 0 3 9 ] 

*fSB^T'fi. •(•'i^;t--?L--T-c >'yi>XTA±Tli^n?)<Di;j<^$fcli#1lJB^*^SJ5:§ 
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^-yhicii. yt>h. T'n-bx, mmumfji Et^-^tti^o 

[ 0 0 4 0 ] 

-g|5c»7:/';'5r->>3 yr-a, m l < mn t ^ tc )sf) y t y h ^ ^ y x h-;i/b*fttiff 
*6.^v^o 'ii>m^£y t y h it^'tn^fy. t ^ u - 9 -( y y t. t l. iS - v f^y r ;i 

[ 0 0 4 1 ] 10 

Windows iSMlSm) X'it. 7*>'hti¥WIND0WS (g^Slf.) ¥FONT 

7 * > h*<ipJfflT- 1 § C i:*^^iiE$ t)ltr'{i*l^„ jif * UV^HfiSm^T'tt. yai^-^ 
AA^Wlndows (^mmm) fiiP \ ^mfSLry iry h Km ■kT.-r^m'^s Cr 
eateScalableFontResource/AddFontResource 
*^©Wi n32 APIlft>*thUT'7*>'h^Sli-r5<tJ.S*^$)5o cniCtt*, 7* 
y hA<i/Xr A7> > hT-7;I/»c}f A^nSo if A*<^ 7 f 5 i: , :t U- t f > 
Xf-A:^f-K{iSlJ<D3a^^AP in^D'tUL (Remov e Fo n t R e s ou r c e'&if 
) 7 * y h * iJ ^ L s i/ X .X A €) 7 r ;i/ % iij 1^ -r 5 c i: ;!)^ T' # ^ o ^']<Dmm^m t 
LX . P - r -< > y X r A - K (i <gM 1^ X h y ;^ a T' W L /c cfc ^ ic A P I M 20 
m^y -y tffX^ ^fttc. *'^b-T'<'yi7''>XxA«r-K(i77-<;l/-9-7" 

>-Xf-A?r<KfflLT. ||^07*> h7r-<;b!&^lltT?nTI/^5'>XrAfcffi®$n§C 

[0042]' 

Mac i ntoshT-tt, COT'n-bxa^tyLTiSO, Mac i n t osh;>XrA7 

!t;I/^(^077'-r;Ui:^^7^r'('7ft:(cS-^*l^TV>S<, L*^LUN I X (SB^m) X' 
a , C £D 7 o -b X « 7 7 'J -^r - >/ 3 y (c -r § „ IfS t - ® 6^ (C « . Ji « «i m T « ^ 
nfc:a^7r'<;l/i:LT7*yhUy-X7!3^->X-rA»ciii)0Sn'g)/ca6, 7*>'h'Jy- 
XfC^iMT'T^'-bX-rScfcA'tT'tSo ^<<DMot. i fv'X-rAT'tt. 7*>MBx!!* 
7*>hUV-X7r^;l/{cBHB-rS'i^SA"tfel.o ctHc^K) . 7:tyh(D»r5^A^pftl(c 30 

% s o Mot i { 1^ fc iii X 7 y <) - y 3 y It . m'rk-^ y y 7s T A ^ fz fc mm^ u m L 

«DI/^-rnA^T*7 * > h^i^D'tBr u i:A'«T'#?.o «5fiT'{i. Mo t 1 ffc'itJFCDE'^- 
Xi/Xf-A<0^<T*, Ad o b eX'>--^7/l/4^XhXi''J7h7;j-yh*^flJffl^nTI/^ 
5 o c <D 7 * y h « s A d 0 b e 7" S if X -r A T' B S -r § ig. S $) i> o fc /£" L fi^ij n 
;!)<fe'5> ±a?OJ;9tc. Wi ndows $/c«-?-cDfti©;i---^U-x-f'y^'-i> 
XrAOK^7*yhWas^XrAfc{^t)5>'XTAA^#ft-rSo. Ad o b e Ty p e 
Managers. fttcO+f-F/^-rfcD^-r 7SSi^X-r A tlHl^tc, C07'P-trX 
tcf-^#fy^'7x-x^«i^-r?., {Si:^HOJi-&, Ccr)fy^f7x-X .-K - h f -S 
*^»^If5*^*i^46§i:i:;i<M$Uv^, ;t^U-r-fy^i/XrA;«"-F(DgW{i> cn 

eos^xr A-r'^T»i:5hffS-rsiiiffl'r>^7x-x^tifl^-r« c i:T'«* < , t^u-f- 40 
^'y^'"^/XrA@W<01^^•7->XrA^cW^r^■rS'f>^7x-x^D*l||fl^■rsi:i:Tfe5. 

[ 0 0 4 3 ] 

i/XTA^CgfcJ:<STtt$S*^ aiiUUNlX (StiiSffll) ±t?«tii«nWi ndo 

ws ;t--^b-T'ry^*i>Xf-A(c^fii^nrc:y7F7x7-J?t^iig?i(*'i'« 
^iCi^m^ n^o Wi ndows (SSK^i) ;!|---?U-T-fy^*->X-rA±C077"';-y- 

3 y fi D 0 s p A T nmrn^^icm < i&<f- L . ryj^-yaym^ioxyho^m 

^fSCilA^^I/^o W i nd ows (^mmm) 9 x/Me^^T'«, a*6^»CtiD0 

s+>-7i>'XTAT$)S/ci6ji /II Bj fig T' ^ < <o iJ3 ?t -r § o 7 y <) ^ - y b y 
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- 7- -( y ^ 7.7- h,ij - V \i. s fSmf^icT-:fV^-'yay(0?i^yfa-txictiLrcn 

[0044] 

(Hl« 

.en S T' /T^ L T t < O CD -ir - X T « . :t U - X ^' > ^* -> X x A ^ ^ tC ^ M b ^ 
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wmtnttet laqohad by IM ^.taadodMrahomi Nbmy'eode ai weD ta vy^tcrn dsvloe driven, fbnli, ragiaBriea andciheraHifltarBiifla 
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OnaUTING SY^mi ABSTBACnON AND FROTECnON lAYER 

Hill appficatitm is a contimistian-itt-pait of U.S. Patent ApplicxtioaNo. 
09/456»lBi the entirety of iwbich is iaoorpartted baem by K&renMas if fiiSy 

setfimh. 

Tlie pmezrt mvcQtiim Tdatos to con^Kiter co^^ 
opentting ^stem sodware. 

BACKGROVNI> OF THE INVKNnON 

b maaj eavinmmaita; tet paitiRifaily fa eavonaments vbae m qipficstnm fa 
dcfivtred via a aetwcd^ tho mosi inqKMart fiwt^ 

widiott I oomplBX iadallstkn. Typioony, k cmafa jnior mt Byrtcms, great pains weie 
to modiQr a cfieot system to appear as if a piognnn wbs instHlled, or w wtnaDy install the 
software itsdC and thai back oat these modifications to reaore the origmal coafiguration. hi 
(tofag this, nmh^le problems prcscnl themselves: conflicts between an apprioation mi the 
cwnputer'B currant configiiratioii, naiKple mstsoces of the same or difemil q^ficatiaas, 
conq>]cxiiy of the hack out process requires an qjplicotk^ 

to eoaire oil of its modificatioiis cod be accounted for. and the use of Ghaied filei and ^em 
coHyonents by imiltbfe appEcatims conyGctf es bsA out mdtha tii.ran,T<«.B p 
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WOD2m»33C9 'PCT/US02/IM7I 
SmMJOX or TBK INVENTION 

TTiejiiBSCiit invention proWdci i fystcmftwf creaiiiig n ipplfcatlcdi mo&ww 
envinmniBnt wilboful duo jinjg n opontting lystcn of i cficnt cxunpnter, tho ^nton 
coo^jrising an operating system ibstxaction and {motectian liytf, '^lerda said abstncdon 
and pTotectkm liyer is iiiteTposa]1>etWBea o nmsbg software spplicaUon mi said 
opezBtiDg systeiQ, whenby d virtual enviioinnaxt in which bq appEcation may run !s 
provided and appUmtion lovtl interacHcos ue snbstmtiany icnxjved. Prdtrahly, any 
dunges directly to tiio operating system ate soleoively made within the conte^ of the 
iimomg appHcatkm and the abstraction and piotoctioo layer dynamically cbsngea the 
virtna] envinmniait according to adxninistrotive settings. AdditioDally, in certain 
embodsnenta, dw system cootinnaUy nwnitoirs die use of shared systein lesourcct tmt 
acts as 0 service to apply and remtrvre cihanges to system con^pnnentA. 

Thuj; fin* example^ in embMSnnenU wifhm \^dow»-based opeiatiiig aystenu^ 
and wherein all operations to die Windows R^istzy are tfarongh the Win32 API, flie 
system prafinbly provides a incans for booking fimclinns^ vdteieby escb time said 
fitnctioBS are isvofced another ftsction or q^Gcatloa mtocepts tibe caO, and tbe qrstem 
moM ptdenMy books each ^ipropziate APISmctxmto aervke a reqnetf 'whether made 
by an qipKcation nm fiom a server or If made by an oppficaJJoQ against a configniation 
key betog acthrdy managed 

In other preftnred endradhnentsofthepKScm invemion, additional fhscdooaUty 
is provided, sncb aa tboae embodtmeots wbereia the operating system absiractioii and 
pzutectioa layer manages the integration of multiple instances of aa applination by 
recognizing bow msny instances of an appEcation are running, arid m soch embodiments 
most preferably it also avoids m&king change^ on starti^ and shutdown unless tiiae is 
only one application instance iumui]g. fn t hw ffi^b nrflmam it is poprf^lp to 
mubi-nser operating systema iiiTiAkh sinlliple instances of an application caa be zunnng 
on behalf of different oaera. 
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wo mmjm pcT/uso2yi537s 

Unu^ flw operating systzm slfstrntion and protoctkM layer pnaentt «n 
envirQinnajt to on gpplicatioa that appears to bo «& fr«*»^'«*hwi eBvinntmcot witfaont 
peffiRDiing an instaZ2«tkia, where^ a '^senjdo fa staHa t km* fa oreatad in which afl of dis 

settings are bnm^ into a virtual eovinmineiit at the time tbe appUcatioo luns. Or b the 
case of aa mstaUed application, act* to dynamically modify the behavior of thu 
appScation at nnHime. Pre&iTedembodhiiejitBptorvideameaiisfoTjmrvcnting 
infbnnatifm m the cUent con^putu- from interfering ox modifViag the bduvior of ao 
^Ucatioa, and roost preferahly prcfvide a means ibr dynamicafly ohaagmg the vittoil 
ODvironiaeat accar^aa to administrativo settings. ^ meattooed above, in oectaia 
embodinieDts it will be possible to have moretlum one instance of a smgle aoidware 
application nntmng on die Batne cHeazt coaipoter, even if it was not ori^nally authored to 
do ao. Insa<^enibodtnieiits,duued,coctEtdIedcoQto[t8s^ 
twoofsaidkstancesofamagleqipficaliiAdianoMoriDcmvi^^ ■ 

BUErOiXSCRIPrfON OF THE INtAWlNGS 

FIQ. 1 is a Uock djagnm admnatic dtovwttg the rebtivc ichttiondup of theprescut 
luveuUDO, aa operataig systena and a soflware appficatioDj 

HG. 2 is a block diagram schemstiG showing 

H€l 3 isa bbcltdiagniin scbetnatic showing 

FTQ. 4 is a bbxJc dtsgram acbematic showing 

PETiUUCD PDSCRIFTION OF THE FRZmiRKD KMBODIMmrS 

Refeoing now to FTQ 1, there is iUustnted a block diBgism schematic showing the 
nfativDzelatioBslup of tiiepreBflnt inveDtioB, aa operalaig syatnn and a sofiwara a pp l k ia ti ciL 
"Prebaei onobodiiueutt of tho preaoBt invoBlian pnmde an opentsag system abstncdon and 
ptrte rt hM Isyer 100 d e n o min ated an *^Opea<hig Syston QBacd." bttflnaiSjf, maooy operating 
systems 10 provide ftuft domains to protect appficfltkna 50 fiom affecting eadh odtor when 
na, Bb>WDver,-dhBied sy^omi lesoincea and matiy other openid&g syi^ai. ftabnts sOow dds 
pcotedton doBiain to be oan^noDdse^ An operating atyston distnctiosi and pmtectiop layer 
100 will provido aa a d d i tional . p t O flrainiuaU c a ily controfled hanitt between appBcathios 50 to 
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gysttm 10 (he opendag system ■bstiactian end pratediai hyer 100 tdectivdy aOows 
d^l^ge>&e^^to^hfl^)|)a^^Jllggysteln lO,vectu>ci)iitahii^Bthfld^ 
die numbg q^Bcatkn. For one eminple^ b Whidows-baeed sytteme, tO apmtiau to (he 
Wiadom Regbby are tjipiully done tfarem^ the Vfh32 API As e^bmed betow. lysera 
fimctioiu Hke Quo^UgEx and GetftofileStriog om be hooked co thit eedi time Aey ire 
'mvolu3d,8iM}dicriiiiictiaaorsniEf»lM^ 71m Opcritiiig System Guard lOO 

of the present invontkm wiS book e«di spprt^niotc API fimcdon to setvicc the request, if 
nude by «a q^plkaticn being activefy nuouscd or if made by m tpp£catiOD aganut a 
conSguntion Hon bong actively nuDiascd. b this way, mlesa explicitly ooofigured to do so^ 
the yiescut tnvcotiM can czeate the qyplicatkin ctxviraQSient tviibaiit mafciofi any actual 
cfaanges to the otd-user's systeia Also^ any nwdificafima nade'tt nnHfane by Aft 
appficstkn can be pezaitted ur iQuoved easily. 



As Qsed heniit tiw texn "OpenU^; Syitjem Oiiard* defiacs • 
'T'"i*t"B ^ipficttioii and the ofieifttiug lysteni jof t tsigst cuuytitcf of cBeot computer that 
pxovidet I vixtoal eavixocBncsn in vddch on q^pUcotim nuy im, Ihli vixniil 
cnraroninoDt has sevenl piiipose& Kist, it ptweids a ''"""'"g tppHct&on fionnaUng 
changes to tte cttent coioptiter. If on application sttenxpts to change underlyhig opendng 
system tetdags of a ^ent conqniter, socfa aetdngs are protected and only "made^ In the 
viitiul ovircmmsnt For eatable, tf an qiplicadon atteo^ to change &e version of a 
diared object ItkeMSVCKTDLL. this change is localized to tibe appficatioo and the code 
xesident on the oUcjit oonyuter b left untmidied. 

Se«»md;tbeiizventioapicseotsaneanaronjcaeiiStQ & luoniag appKcation that 
•ppcan lo be BD installation envirooment withom perfimning an installation, and ia tbns a 
*^teado iastanatinn'* or 'Sostinatkai'lilce.'' AOofthesctthigsarBhraoghtintoavjTtaal 
enviroamoit at die tine the appficoiion beng served nas, or jtist-in-tinu M^ieo tbe 
'application needs the pazticDiar setttng. For eamnyle, if a compcter p rog ra m sndi as 
Adobe Phocoshop® expects to see s set of V^dowsRes^tfry entiies under 
HKEYJLOCAL_MACHINE\Software\Adobe and they are not there on the cEout 
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wo vuansa pct/usovisjtii 

compiiter nnce 71kOtoA<9 Tvas never iastaOed, • aystem 

ttspect of the presem joveuHoo wiU *ttoVtiiow zegjstiy entiies totbo J^MoAap 

prognnmii&d oodo cstictly is if fbeyweie tesidcst ontbo cHcwt coB^iter. 

Nbct, the tuvtaittan prevents infonnttion that may endA on dia cfieatAisen - 
maduDofiomioteifidDgmtli or loodifymg the bdunm^ Faiegasg»l^ 
if the nser has aJresdy odstmg losistry entiies inkto^ 

HKEyjX>CALJ4ACHINE\SofiwRro\Adob© 
Jbr an older vssion of1%oto^op, hut now wishes to qperste a newer version, these 
entries can be hidden &ozd the new t^licstion to prevent conflicU 

nnslly, Ihcjrresent inveiitian unlocis i^licstion behavior that nay not exist as 
the qiplication is cnrrently written, it does this through the ability to dynanucally change 
tbe virtual environment sccording to ftdniint<lratiye ix!tting». For exrmplc, tn a typical 
fastanco (tf an cnterpiise software appKcation, a clieni a^EcstiaD may expea to read a 
settbg for Ifae address of the dBtabaie to TiUeh tin oscT dioaU oomeM flora ^ 
the regiatfy. Because this registry key is oSen stored hi HKBY_LOCAL_MACHINE, the 
seohigisglbhallbrlhe estflreclieoleoiqmter. AttsercanoalycoDaecttoaaedatthsse 
i^tfaoiit remstaning the cfieni, or knowing bow to modify this rfg^stiy key, and ddag so 
eacbtiiiioaieywblitonmUMan»Hcat]oa. Howevei;by implemBD^gUiepxeseat 
-inventiol^ rwn mstancea oftlie 8n>ficaUoft ouy. BOW nn on dte sam 
each ooonectmg to a tffi&rent datahasa 

CONTEXTS 

hi providhig this fiinciiflriaKty, each eppHcatko is able to ran in a private conteRt 
wKhin the system. Tolheappficatiaa,itha8itsowof»Weviewofindiatthe«y6^ 
looks like and its hdurvMtf. The present srveoiiDn provides this by its iaherentiutare. 
Reftnbg to FIO. 2, two scpsrste appficatitms 52,54. or two mstances of the sano 
appHoatton (50 iDostrsted hi FIOL IX can be provided private contexts in vriucb they will 
appear to have aepsrate or diflsiiug oopics of systein service^ ccniiguratioa and data, b 
dieprefierred embo£nM»t,'lhis Is the de&nh behavior of tiie aystem. 
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By extending tfaia concqit, tho Operaiisg System Ouaid 100 of the present 
iinfeolion cin abo jnovide ab«jed, controDed contexts in which tm or more qipHcatiani 
52^ cm Aaro nuxio or tiQ of Aar virtua) settings. Thiit is inqionant For ippficntoe 
suites SDdi as MicrDsoA Office, or fixr ■ppUcaiims tfisl perfomi diflbrBotly in tlta 
presmra cfodta i^ilicitiaras. Fax oamtpte^ mtay oppKcatinos en MicroMifl Wmd as 
an eo^ne ibx dcHng fSnl Mexge or downem oeatioo fimctiooafity. Tho appEcation 
mnst Joiow about &e manBation or piBscoce ofWocd and be able to taploto iu 
fi n> cri o B& la the preSared enbodhuent, two instances of the sane application will thaie 
a ringle c<»text by default, while two sepsnte appticftttnns will mafaitab private 
contexts. Referring to FTG. 3. the two applications 32,54 c«n nm ^ile the Operating 
Jystem Qnaid 10O provides a Aared view of the available system l e ao u icea. 

lESlGN 

As illnsaiited ia no. 4, the ppecatiiig System Chiaid is cos^^ 
bUowiog subsystems: core 102; ooofignralioii nmeger 104, file manager 106; thared 
ibjeot naoaget I08» device manager 110, fbat manager 112. process manager 120, 
nboess en^rooioBat manager 114, loader 116, toAxtoanty manager 118. "With the 
neptiott of fhe coie 102, the pniceas maaager 120, aad Ihe loader 116, aD ofhcr 
idMystems are elemeiits of &e ViRiiaHzvtiflD System descdbed k 
ilie cimi 102 is ptimaiify lesponsibte managing qppficatioiis jDid tfae^ 
leSned by the configniation files. 

The process nanager 120 pnjfvided by the OperatiQK System Goard atbws the 
«re 102 to be iofbimed of any process or thread event tlui may be of interest U also 
irovidesaa abstzBCtioo layo-tp the opoiting ^em-depeadem implcmaUatioa) Eoa 
nanaging a process q>ice and handling thieid proccssine. Processes may be gcoaped 
ogetAer bto appCcstton bundleiL An application bundle is a grocp of proccDSes %'vliicb all 
bMit their vhtnal ncsomoes with eocb other. Far example. Microsofi Word aod MIcrosoA 
\xcel may waot to share the viitual regisliy oad virraal file system to be able to woric 
ognher'as an ag^Iication aohe. The procesa manager 120 caUa these applicatioo bundles 
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"appHcsticos". The infanaatian about sn nppficotion exists until tho process sanager 120 
is told to nknaa the appficstkn. If another process seeds to be loaded into the 8pp£c&tiaii 
tandle^ & nny do 80 as loog ts dio B^licstioa has oDt been 

Uic loader nbsystem 1 16 of the pieseathsveotfaio li used to allow virtDal 
cnvironQienta tobetransfeired Into and out of the mmlng system. Escih of die 
^^rtiufizatiaa Sub^stems Is capable of serislii^ its oaafigniatioa fiir the loader 1 16, 
andietrieviBgittlinnig^theiwenepToooBS. In additian, the loader 116 is capable of 
stBg/Bd loadiiieAiiiIoadhg and oondimiDg thereaobs of mdividiul stages into coo sfaigle 
eBvirannuat deso^rtioo. 

REGICTRY AND CONFIGURATION 

AppUcatioas require varying amoimia of coiJlgiirstioB bfbimation to operate 
piopofy. Asywhero from zero to thonsands of configaration records eodst for which an 
appficsttoo cao read its configuration On Windows, there are two oommon places for 
confrgoTBtkni in&rniatlon, the Windows R^stry sad system level ftutiafizadon files 
wiiLini and aysteoiini Toadditioi^theXWINDOWSNSYStl^MdirectoiyiaacoinouHt . 
place fiir app&ttioaa to ynko education specific caaSgantioa or lidtiaHadoa files. 
Applkatioiis wiU also use configuration or data iiles h dieir local appUc 
to atore additianal configmatkin infimnsUnn. Often this infbrmatlon is dlfficolt to deal 
with,8Sli iaioapnipiietaiy formal. Oi platlbtms other than Windowst then is no 
eqsivaleat of the RcgiEtiy, hut commoa diiectoties exist for coofigunttion tofbrniation. X 
Windows has an app-definilts directory. MscintoA has the System Folder, and other 
Dpenting systems will have GorreqMndingelenieiits. Bisin^oitanttonatediatanniost 
UNXXqntems^ ead ittfividnal spplicatioB 5^24 wiU most ofiea store its own 
oonGgDiatioD 152»154 local^, as seat in HO. 2. 

The present inventioo, in one embodiment, inclodes a viztnal\^dow9Re^ustiy 
conqKtneQt, v^uch mil provide a fall fbnction registry to an appfication, but prevent 
modificatim to the imderlyiDg aystem registry. AH keys that an appficatton expects to 
acoesswinbeprescot,biitmByDDly exist m the viitaalTBgistiy. bx this way, fbn 
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PpentiDg System Oiurd 100 of fbe pieteat inveiitum and Ac \ffrndmn Rc^tauy finim a 
two-fit^ie piooesB Sir accea^g the regjistiy. If «a afpfidtkn needs access to s key, it 
vjSI query flie Registry. The Openitng System ODArdv^ToqpandTvith&el^ 
vahieiflt knows it. Oitowite, it wOIjiOcwtfaezetraesttopassaroas^toi^ 
Regjstiy. ir«aiaQiqMisiiuden>mo^tiieimbi0kl^OpeatihvSy^ 
iSow the modificatkm to occur to itself QDly. Hw next tfano die ^ijiBtatiaBBGoesseste 
key, it vviD be presort in the Openttisa Systcni Oasid aod tbe reqn^ 
fbraiq^ to iIm 2(<eistiy« Inving ft 

The keys that the Operating System Guard uses arc spedOed in lloee separate 
BcctiiMis. These C^>cratiiig Syatcm Qnard keys are ^edfied as commands to. these 
SMAioBS to modify an existing key, delete tbe presenile of a key, or add a new 
iQgistiy. b this way, the virtual x^jstiy can i^pearcoactly as tlie system ii^ds. Ilusis 
in:Q>ottant as the presence or absence of a key can bs as inqMOtant as the actual vahie of 
the key. 

Jb the pretoed esabodnifiot* &c Open^ System Gu 
dutoontahia bade lei^stiyeottiesAr the Hun a SMond data ffle is loaded 

that eoutafais the user's pxefbenoes. HnsIIy, the Operating System Goaid can optionally 
Josd a set of keys tbit iachdo policy items that t3ie oser is not aflowod to oveiddo. The 
three ffles kMd on top of each odia wUi dq>ficate hems hi each file ovenjdhig Jtenu hi 
the file before & The first tbne a nserruns an ai^fioation, the second data file will not 
e^st because there wiD be no UBer-9ecifichi&rnstkn,oafyqipficatioadefini]t8. After 
each sessioii, though, the C^ersting System Guard mil save the user's changes, 
generathig diat second data file foruse b fiitore acsskma. 

Canfigvntioa files can be modified ra two tvayB. First, the file can be edited 
directly by on appficatioa In this scenario, the Operafting Syaicm &urd FOo sobsystcm 
described below win address the modification made to the file. Second, in the pieforcd 
embodiment, as application can caO tho Windows API fiunily of calls Oetl^ofileStriag, 
WntaKrofileSttbtg, or otiieiato modify these filesi In tUs case, tiie Operatiag System 
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Opard of tbs present invootkn perfbimfl exactly as deaeiibed abovs intercepting ibeso 
C&nstndservicmgihem from within. 

SHABia> OBJECTS 

Mnny conqxmeota med by oportting ByBtoms «ad nmning appUcadons &re shared 
across several sppfications or iostaiicea. b geaeml, tins is a vcory good idea. 1i saves disk 
space, D0( requidog many copies of the same file. B also provides the ability for 
cpenittng system vendon and third paitiea to create and duttribnte Ithraricii or comnwnly 
used code. On tbe Windows platfbnn, Dynaioic Link librariea, DI Jji, are o Rot ahared 
Tvitfun end aoroas a^fieatioa% (Xt other plat&mu^ the piDhlem is the same On the 
MacintDah, INTTs and oOier iqntom ctmipouciita are loaded fixr applicatiDits. The«e 
ccmpiueotsean have many vcoimu,afwhiditNilycMie is OnTJNDC 
wftttna, dynamic dtaied o1i(}eots, e.g., *.Bo"Ubnu7 files^ ore used hy appfieationsto 
9eed load tone. Rave disk 9aiw, and lor other reasima. -Maiqr pcograms use the default 
libcaa" HotwAvv;1hasiibfBiy fileisQpically a ^ynlxilicfiDk 
sud ashlieLaoJ. bpnoicG^ this ftatnre has created hsvoa These shaxed conipoBents 
have ofieo gonelhrou^ leviiBon, wiib many veEaioas of the same coB^oMBit ayailahlB to 
be ittStaTted. ^p&atia aadiarBhave fouod their software to wodt withpt^entialty only 
one or some of die ventons of the shared con^anent Thna, in piacticc^ sppEcations 
typically instaD Am vocnmfheydeaire^ovefwzitiago^ TUs 
potcntisUy cam definiu in other qipficationi nn^^ 

On ^dows 98, Windows 2000. Microsoft has created tlie Windows Protected 
Bis System (WPFS).to allow system admmistrators to create a fils called 
XXXXLOCALinthebasediicctoxyafaaqjplicatian, where XXXX is the executable 
file name wiilmat die exteoaon. This caoses die Wiodowa Loader to alter its method of 
resolving paArefaeacesdoriagLoadLibiajyexecmioina Thia^ however, is not snffidoit 
to coo^letely solve tbe problem. First, setting up the XXXX file is lefi to tbe knowledge 
ofthe system administrator, vtiiichvanes widely. Second, a cmiponeixt version most 
undergo a rewind bac3c to the ozigma], then install this ^mponent in the local directory, 
and then create the MjOCAL" file. TUsianotaBtnightfosrwaid^oceaafitf snyhntihe 
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nwtf baaooomiwDmUpUcedb WINnDOWS\SYStEM. Also, tkissi^oD does Bot 
cover att of flu needed fimodoDifity, Daring LoadUlneTy, Windows itaesdifffare&tpatb - 
Rmtation semantka dcpauUng on vActbeor ibe oongjoronl yns resolved as a reaik of «n 
n^Ucit or io^lioit LoadLihcaty, i»d also vAcdw 

i8a]»mBd,or.wdI-k]ionii,DLL latfdsfsse^theLoadlifnaiycaUwai&hviysxesQlve 
to this WINDOWSVSnrffrEM Hactoty. 

DIXb and otbec diared coiq>oiU3in ailso ittMn r e ft reoce count semaiitics to 
Munn that a componeiit is itot toadied imiess no rnimmgB^ la 
practice only tpplacttkmK fimnfte operattng ^^stem -vendor Ad the opentiqg system 
itself bavD done a good job of obeying this protocol 

As a genenliulc, it is desired to bave a Stared object always resolve to tbe 
conect conqjonenL To provide this iunctionality it is required to understand the version 
of a con^onent, or lanse of veraons, diat an ;qipScation is able to fimctioo with. Tbm, 
vsdien the oppbcatioa is to be nm, the present inventioD sbonld eosure that the componeftt 
is resolved coneGt^. ft is acceptable, in the present investion, to ootonute the use of 

or other opentiag system provided capabflity, if dedred In idiis case, H is 
necessary to deteot needed components and place ihem m the local file system. This is 
more conq;ihnt Oso jnsiTvatduns mstaHation, as an bsullation profrsm wfll often not 
install a conqioaait if the reqnired one is already tiiere. 

Jt is desired to identify a tnedtod to ensore that named ol^ects ove abn hnded 
ooneotly. On the Wbdows pbtiomi. MSVCRT.DIX is a a^goificant colpiit witfain tins 
problem area. If naihiplevBrBoiuoflhUoldectaremaiDtahed,aoa&reowntic^ 
Registry key can be dynamically changed, allowing the LoadLflmry ftmction to resohre 
the correct oon^onenl veruon. Anodier rcascnsble method of ensuring conect 
oonqionent loading is the dynamio editing of a process environment to nse a valid search 
path. This search path wiQ ensure that a local com p onent is resolved befiire-a system 
mdc ctymptmeat. Another possible method for tesohdtDn ofiaxB cmrea diand ohjea is 
through the use of qanholio lhik& A synibofic link can be made Bv a dared component. 
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•which is resolved at niD-timo by the con9>utear'fi file system to tbe needed conponenL 
TinaQy, the actual open/resd/dow i«(jnestB for inSoxms^iaa fiom a shared obfect't file 
can be intorcapted by thepnseot lavontioii and ce^onded to dynatmoally Air Ao comet 
voBOD of flie file wliich may wdst on tb.e local system or -within the inveatkM's 
sobiysienuL 

Several fecial fonns enst. Oatbe Windcnvsplatlbnii, OLE, ODBC; MDXc; ... 
as we& as a nundier of other vendor specific cozoponents, are written to be dured 
gbbally among several or an ruanlBg procesees. ]tat1k6ca8eofO!LE,gDnigBSfivas 
during data and nwtnwy spaeo between separata processes. OLB ptneveats mare tbaa 
one copy of itself ronning at a time, as do many of these coanponeiita OLE also has 
masy bugs and features le^niriiig a q>eciGc venioa to be loaded &or a qMdfic 
appUcatioD. XntbepreaeMiiivcntkm, snqrpGcatianiidlotoloadiisilutevervendoDof 
OLE is reqalred, still enabllQg the loured semantics itfitti odur ocmqKmems nahg 
sajmoversioo of 0L£. 

In eenetal, tmless ^edfically coofignred as soch, sluani objects AavHd be loaded 
privately to onsure conflict pneveation. Notluog sboot the method used to allow a 
conq)oiieiit to be loaded privately should pieveot it &om bnng imloaded deasly or 
CQirectly loading for another software oppEcation, v&ether benig active^ msnaged by 
tits Op«tatiag System Ooard or not. InaddftioOfifdiecystancnaiheaitiarBqaitedto 
xecover fiom thk cansh to a dean states notliaviag oveswdttoi or mo^fiedf^ 
imdeilying c^ienting ayatem. 

ULES 

Many a^licatioas nse data files within the qtpOoation to store configniatiaa 
entries or other sppCcatlon data. Tbe present ifl:vention provides a virtual file system 
nmch like the virtual registry dcscdbed above. Before the appHcatioa starts the present 
icvation can load a list of file sy.stem changes, including files to hide and £ies to add to 
the virtual envinmment or files to redirect to another within the viitoal envinnunent. 
Whenever tiio applioation accesses or modifies any files, the Operating System Qnard 
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checks if the filo moa be ndiircted, tod if 80, m the prc^ 

Tcqoestto B location specified m tbo Opofstiog System Ouanl coafiguratioa. 

If an spplicfltKm tries to create a new file or apea an existmg file for wntbs on a 
user's local driv^ tb« Operatias System Guard toast oisure that the Jfile is actoally 
created or modified in the redirected bcation. If the application is reloaded at a later time^ 
tlds fib nxapping nnst bo ndoidod iBto flio OpciHtiug Syitom Guard vimal euviroiuiMBtL 
When the reqiiest b to modify oa eadsdqg Sio, witiehxesidea an a user's local dzive^ die 
O^enrtinff System Ooird nmst copy the file hi qiMsticBk to tiie refiiecdoa pota^ 
coptimripg with ttie request. The ledirected files may not be of iho samenmno ai the 
oiigiiul file to easoie safe mapphigbf file paths, h the pr e ftn t d embodimenl, INI files 
ere handled m tMa way to oCEer anximaixi system security while alknvini; maxhrnim 
appSesliQii codspatfliiUty. 

The pcesenl hnwation is paiticuhuly osefiil for oppIicatioQs delivered over a 
netwodt In aiufa iiiqdeiBC3it«i)c»8 it u io^^ 

are made, of several kmdt of data, where the bulk of the files a software applicstton uses 
are most prefhraUy mounted isn a separate logical drive. Confiiguration, indodhig both 
file based and registry based, can be user specific and synonvtode. The application 
delivery system oaed d»mld mark each file for viAneh ofthese types any file is. This 
mfiumatim provides hints to the Operating System Guard system to net on appro p ri ately. 

Many qvpiications use device driven or other opciatisg systenoL level softwaiti to 
iiii|ilBii>eiit aome of its fimctions soch aa har dware soppon or low levcd fattoractions 
directly with the qperattqg system hi tho preaeit nveotion, the Opexatmg System Guard 
w31 provide the capability of dynaimcally, and as possible pzfvstely, adding and 
ranoving fbese coooponests to en appHcstioa's viftsal cnviionzncDt> 



Many device drsvers are bmh to be dynamically losdable. If at aQ possible, it is 
the picfinedeidtodimBnt to load aUdcndce drivers dtynamtcaQy. fF a dervioe diiva 
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lequires statk load at boot time, tHo user must be prcRentod wUb this Icnowledgo before 
nmniag the applicstko. Onoe the system has rdboaici^ the appHcation should cootjoue 
from where it left oS. Howovei, a Urge pcrccatago of device diiveis tat not dynsiDically 
nnloodabte. AJthmtgh it is preferred to dynandcaQ}/ unhnd the ddvcr, if this eaimot be 
Bccon^^lished the driver be niaikcd for removBl on the oeoit reboot, and the user 
sliouldbBinadetwsTeofthis. If tho applicatioii is cin « secoad time befbre tfie nott 
rdwot, the systasihooUxomun iwne ofl&eprew&ee oftbe ddvcr ud oocattenpt a 
fieeond iastDllBtioiv m&ioB fiv temAunkA 
reboot 

* It it iiq)oiiim to duracterize the base aioiilaritics and difier^^ 
ibr each devise driver dass, to eiu&re the present hiventioa can conectl^ Bb 
not truly desired to load and unload device driven lystem hanhvsre that is canatantly 
ptetcat . It shoqld be understood that aJthough this ia not a p re faie d enhodiment'm 
tenss of pn>granmiing ease^ it Is vt^hffl the scope of the 
reqoircd for tpedSc reason^ soch sa the itEtxktion is liceosiog ag^^ 
sppUcations that are delivered and nmnsiog fliepreseat mvontiou. 

On noo^bficrosofl platfbnn^ device difvors are typically handled very differeatly. 
Madmodi systems aippoit both static and dynaaio drivers^ but they ore aH instaUsd and 
Tcmoved dtrongb the same method TinHng ^yiih the Macnrto A system fiilder will 
provide the oecessary support. For UNIX Bystenw, device drivers most typically requhe 
a modificstifBi to the rmimg UNIX kernel followed by a reboot Thia process can bs 
very ooiqilex. b the preferred embodiment, thin pmceiu ta mitomatcd; behiding 
melting the kerne) once the tq>p]ioaiUoa is coaaplde. The goosnl parBmeteii of the 
piocea uetho ama'astbst described above fbr Wkdowt appBcations. the actoal process 
GtqM of coispilatmB and persons ftn^isr with mch nperatfaig synoms can carry out 
fcboot 
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reoovoriiidnmDvedriv»icn)flsqFitcm£ulnre WhatevwdataorpiDoeBtesjkeGesauy 
to icttfn syiteiii integrity bib thcnSvp s jncftncd Qnhodiiuaut of tbo present iuvcutiQii. 
Those ofddD in the irt'wQlilwiiipQrecisteiJut diivmnriglitiiaibe 
canvcniently ot cGBcieotly provided vis the present uivoutioot most pntjculnly ibose 
assoGuted wUi pennanoit hsdwaie sttacbod devils 



OTUER ITEMS 

Is the presod iavestion, hU recognized that there «i« several componeots of the', 
bventioo, the behavior or piesence ofwldch is different ou nbcniate operatioe systems. 
These components incbde fonts, procesGca, cnvaonixiBTd variables, and others. 

Some Bpplfcftkms reqnoe fonts to be insulted in order to perfann oonrectly. Any 
fiMtttieqoired^vil] be q>ecified in the Opentfaig System Guard's conGgnrstioa file. The 
C^eretiog System Gostd wiD enaUe these fonts prior to ranning Uie appGdrtion and if 
necossuy mnovo tbou lAenvBxds. Most q^stenu havo s cnninion sreo donto of 
fbnts in add&lon to a process fiv ngbtciiitg iheoi m naldng the systoniawaso of tbdr 
presence, the Opentkg System Goaid mil utilize these ivaUable methods. 

Qo^dows^ a fool is oopfed to the\WINDC>WS\FONTS direotmy. This 
howover does lurtgoaraam that tho&MhtvaibblB to the xm^ Iodic 
piuSoKred emboifimeot. if die piogrun OSes the iwindowi An 
need to be repstered wiA a VTisaz API caO soch as CreateSoalableFontBesonroe/ . 
AddFonlRcsoniuB. TUs wfll insert the fimtim^) the system fint table. OUce eoxqplete, 
die Opentiog System Guard can remove (he font with anodier tpprapnuxe ABl ctU Wte 
Bem0vifaiitRescnirce,disn remove die file fiom the system. As an shoisate . 
embodiment, the Qperiting System Guard oooHhocA die API fimctioas ss described in 
the virtual re^stiy method. In additian, the Operothig System Guard can uso its Bk 
SQbsystem to avoid placxng the actual £mt file is die ranning systemu 

On Afsdnto^ the process is extremely sifflihv and based oo filea ia the 
Macintosh system folder sad teajatration acdviiioo. On UNIX; however, the process Is 
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dependent iq>OD the ippUeatioB. Mos typically, fimtreMoreestre added to tbosy^^ 
ic^iUarfileiretohrediDdiejiropartocatioii^aofheycanbei^^ With 
many Motif Bystema^ a font descriptiaa iieedft to 1w placed 

wiQ allow dke fimt to be resolved. The Motif or X appficatkm can invoke the fint dtber 
dinraghtlieresohitionsDhsysteiDorbya directcalL Kacently, mmy Motif and CDB 
^sed systems iitiHze Adobe scalable postscript fi«it& Tbesa fints need to managed 
tbiough the Adobe type mattsgemeot system. Tliere arc exception^ however, and as 
GtAted above» there are aKemstes to the Wbuknvs or other openting system defimh fimt 
ntaoagemeot systems. The Adobe T>pe Manager pnmdes some thcDute intcc&cea for 
this process, as do other third pojty type management systems, hi most cases h ^ouU be 
decided whether to Eiqipoit the tDtexlkce or ignore ic The ptnpose of Opentiog System 
Ooaid is aot to pHTvide a mdveoal la^o ftc aU Aese q^tteaai^ only to do BO fbr ^ 
operating Q^stoD^s o^Mi'sahsystem 

MsiQriqtplisaTioasreqDireeimnioiiKxitvara This is most oammoa 

. ooUNIX ^steni^ but b also heavityiised by tbSbwwn, vMet was oc^bally.wnttcn <n 
UNDC and poted to the vnadowsopeniing ^sterns, .^rpficationscia the Windows 
opemtiQg systems heavily leity on thoDOS PATH enwDnnwai vniable and often set 
their own appficstioii spedfio entiiesw On the Wmdows 9xMe cnviroameiitfl^ tiieic are 
loniyeaviianmentsettbg^ whkib an applicable at aliU cm Is tt^ If 
an qipCcarioQ rsqnirea the presence of specific variable*, orvabea to be ad hi aristbg 
. oniraiiiiiaitvirUUei^iheieqnirodenvirtnvtRitvirte 
Openttng System GuanTs configuration filcL The Opentina System Guard will aet flwce 
variables ^r tiie application's main process when it is launched. As applications do not 
typically change esvinnunent settings aa they operate^ the vntuiiBJ eonriroameot wxD not 
ttap these calls^ nor will it provide the fiiO coioplemenl of fimctionality tbtt tltt r^istiy 
and ro** ^gB^*^ *^ subsystem doesL 



RECOVERY 

In some cases diown in the previous cectiona^ actual modtficaticms mnst he made 
to the opetatmg system This is fieqoent with device drtveri and foots, b addition. 
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the next timp an qjp£citiaa is nm. It is irequired ihat the Openting System Goaxti syttem 
be d>lo tojtcover ihMii daages tothe fyOenv lemwtag llie chii^e fipm Iho tgPma «t 
ht earliest possible Ofiportniity. Atteniately, if tlie system cmbes during tn 
^1icatioa*8 execadao, tbe Openting SyAem Goard dionM tiadt enonfiib infiinnticm to 
rcntove any dui^to the wyttem if it isrAooted or ofterwiiie^ imd dunild track die 
diaages nude to tlie vntaaIeiivinmiseBt. 'Ia tbepre&ned entbo^ineDt, fins is 
lii^}lcmeiited as a transactioi) log, but can in other endioditiieirts be done as nomo other 
similar con^omem, v^iidi con be reed on systen dertiip so that diaoges can bebadud 



CONTROLLING VIBTUAlDiATION 

An izq^<»tnt aspea of the inveiition iditea to oduzoI of the many fltcda of 
■viitualizflidQn Wikb the Operatiiig System Gnnd is capable o£ bi the prefiaocd 
cmbodiinDm Oiere edsts an iostnuoentation prbg^ able to aaoert^ 
ofanftwareiyttemtDContiid. Alaobdhidedianinediodtodlowaibaialstntorsattd 
end nsen to view and tfiose item to be vbtnaHzed by the ^stem. 



b the atttomatedpRiflptaii^ the «i^catbn to be cmitnined la observed in order to 
gauge tbeaqpectf of eoDlniL tba amomated program b oapabto of p ci i b m i b g Has taA 
doriag tbe iostnllation process of Ae appfication, doxiog nsh-tiioe of the ai^&atian^ or a 
combiurtion of both. In the prefianed eabodimeat, the Openrtiog System Guard is 
embedded in a wrqjper qipficatioiL Post installation, or afier ooe or many ogcs of the 
software, the wrappa i^ficatioa will qoeiy the Optzating System Guard Ibr t detailed 
list of an of its actions. Irom (his list of actions, the xwrapper application win create ibe 
con^ijxatian files teqojred to load and operate Ibe Operatzog Systtm Goaid oa 
■obseqiient nse& 

If used as pan of the mstallatios process, the Operating System Ouaid, in the 
inefexred embodnoeat, mil act as a viitoal byer allawing the instalktion to be entered 
fauo Its enyirDnSKiit only. After the ftataHation, aB of the filea, csttingi, et al can be 
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duinpedfiirrdiMul liter, b this my, tfwiiistftllitimwOI leave l3ieonipiialay^ 
and win hove mtomaticaDy creited the necessary ccnfignntioD filea WbcD used during 
nse of die appfiostioii, fbe OpentiDg SyEteoi Ouazd atilo to leomd either dUTefenlMl 
nxxfifioatinns to the eaviraninent, or reco^fy the canfigaatica fibs. 



The Operating System Oasrd win pass its in&nnatk^ 
fisr post-processing .latbepnfhoed essbodimcm.kodditiooto.dientoni^ 
Ast the $ystem can oeate, the wrapper s^Hcxtion Is pr o g r am mgd mth openthxg system 
spedfic and applicatkui or domain ^ecific knowledge. Hds knowledge U used to aher 
the output of the process to reflect known oses of configuration hems or other entrieSi lb 
the preferred embodiment, a mlea^based syatena Is ensployed to oorapste observed 
behsvion with known cceoarios in oider Co efibct duntges cotlie oodSng. 

The wrapper application is also used as a viewer and/or editor for the 
oonfifiuntion output of the process. This editor, in the preferred embodixnent, enables a 
^nem gdminxstrator to add, edit, or delete items or groops of ftema &om the 
ooBfi^DWtiooL Xft obsdvio^ con fi ffli 1 1*^ tbroii^^ tbo odjtoTy tiio odiiBiiiscrstor cso 
also nuke npficas of tho ooofigiintian, duaging q>edfic items as oeeded to tfea 
qipfiaition level <v nser cnstom changes 



Re&aingflowtoFlG. I, an earixtdimenl of the present iaveation is IDttstrated 
fimctionally. In tbis eiaibodinieot, two sets of appltcationAuer data 60 ore iUnstrated 
The OperatiDg System Gtuid 100 keeps the two instaaoosofthoappficaXton 50 flom 
. interfering with one another. In addition, as enqdanied above, Ae opwating system guard 
• 100 serves aa an absbnctkn layer and as such collects camnumds and comnmnications 
between the application software SO and the actual operating system 10 of the client 
canqpntn. As iUustrated grnpfaicany hy the anows^ ceitain commands no between the 
Operating System Guard and the sofiwme q>pHcatk>a, this b in distinction to typical 
instaSatians vAere tb^ commands would instead be acted opon by the openting system 
itflel^ lesultfflg in dtangiBSto the cfient cmt^fiita 
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opentor imendod. Qa tbe other Imid. otber conmandj pw dvoogh the Optfstiiis 
System Ound tad tiro tiKctrBiisftxred Co the Opergtbg System itself 

While Oil isvaitMahsi been puticiiliily shown oad described vAth Rftrenees to 
pxefened embodimeBts thereof; it-wQl bemdentood by those skilled fai (he utOat 
vsrioos changes fai Eonn and details nuy be made tberek 'without depeitbig fion the 
Boope of the Hiveotioii encotr^&iued by the appended claims. 
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WbattscUuaeais: ' 



L A Kyetem fig etearing aw appBeatbm anftiwra ijruliMiiiiiwn| <»ij>^mi^ ^yigtpg n 

0|i<) rfl l !nB Q^ttDL <tf s c&ent ocMupntfif, tho Qrstcni cooipiisiiig an openUog syttom 
lAaUmsdim mdfnuedmhyat vAadn tad »bstncdou jud proteciiaii Uyer is 
interposed betweai a nmniiig aoftware qipficatioo nd add opflndog systen^ wbereby a 
yirtiul euvliuiuDent b inducfa in ^licstiin ouy nin b pravided snd appVcatioQ level 
iatenetiaiis an nbsuntiBDy icmoved. 

2. The qrstem of claim 1, whoroiD changes directly to tbe operatiiig systeni no 
selectively made vvitlus &e contnl of die raining ^ppUcstion. 

3. Tbe system of daxm 2, v^^ierein the abstnctkm aad procectioit layer dynamically 
diangcs tlio viitofll entvirooium Qccordins to adnoniiitxstlvQ settings. 

4. The system of claim 1 , wherein the syetem cominQAUy moniton the ose of xbued 
syBtem xesourcea and acts as a service to apply aad remove changes to system 
oonipooentsL 



5. Tlio Eystem of dain 1, vAetdn the opcntkg syston is a Window9>hssed qienting 
system^ and vhmm all open&ma to tho W&dowsResjstJty and ial files are dmmggh the 
Win32 AFI. the system fimher conpzisiBg a means fi» hoofciag fanctitma^ whereby cadi 
time said fim crio n s are innroked anotlior finction or qiplicstion hdexcepts the caa 

6. The system of chim 5, wherein tho qfsiem hooks esdi app rop ri sto APT fimctiim to 
sendee areqcesfMiuSher made by an appBcstian ran ftmn a server or if made by an 

' sppBcatiota against a confignzation key.being activdy managed 

7. The system of ckim 1, wfacidn said operstmg system abstxaction ondprotectioa layer 
manages the integiaikn of moh^le instances of so grplicatiap by recogtdamg li0w.insny 
instances of an spplicatitA sre vom^ng. 
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8. The system of cbnn 7, vAaaa sold openting system Bbatracdoa andpratedian layw 
•virids Boking obliges on sUitiqr and diiitdown unless fbere Is only one ^Heitioa 

9. Hw system of cisim t, wherein said apenting i^em abstnctim and pratectioa layer 
piescats an eavirottiDgittto an ippKcatiantbal appcaratp be an ftHUOatiop eaviiofupeat 
•wMioia pBtftmniiig an hiiitatlgtiqn, vAim^ * *^8eiida{attillatiiMi'*isaeatedinwliicii 
aS of fhe settlnga m Inooglit iitto a virtul enviz^^ 

10. TlwBystemofclaimP.fiiitherooii^iziaiig a OKsiisfbcpreTO 
dient coopottt fiooa ktofiiittft w modii^ing the bdiavto 

11; The system of claim 9, £titber cgnyrisias 8 mfisns for dynamically dunging the 
-vntoal eaviromnflit acceidzog to sdmiiustTStive seltjngs. 

12. Hie system of claim 9, vdiercin moze than one iostsnce of a single software 
sppJIoitkp runs oa the same client oompnter, a|id whorefai eadi of said aore disa one 
instance ctmnects to a difierent datahose 

13. The system of claim 12, whmeio sbazed. cootiolied contexts stb provided b which it 
least two of said nutancca of a mngle appBeitlon diaie one or moce vhtud setdngs. 

14. The' system of claim 1, fiutber conqiiisbg a device driver monitor that receives 
instroctiODS at the time of hittsgattoa fig a patttenlar appUeation. 

15. Tlwaystmn of chdml.finlbcreoiivnfliDg a ^^rtual Windows BegistryGon^ 
provide s fii& fimctioo registiy to nn appHcitioa, but pieveot modificadon to the 
mderlymg syatem regjstiy. 
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rapondsmiihalHyuiditavalaeifsaidkByaiidvMbiemctci^ 
qfStemsbstRcttaniBdproleotkabya,i^ opening s)^strajabstncd3on 

and potecdon }ay« Blkiws the reqfoest to pass tl^^ 

17. The system of claim 16, v/herehi if an attempt isjDudetoniodiiytfie value of aid 
key, the operotiag system absCnrcium aod pmtectian layer oOowi Ae modificBtioii 10 
occur to itself only. 
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